[Extensions] Don't allow content scripts on the New Tab Page

chrome/browser/extensions/content_script_apitest.cc

Index: chrome/browser/extensions/content_script_apitest.cc
diff --git a/chrome/browser/extensions/content_script_apitest.cc b/chrome/browser/extensions/content_script_apitest.cc
index 242b99ddbed745b2542336ab3d686dc2684d782e..5ff39e4ce1d7ba9659999c69c04ff4ca394abd5f 100644
--- a/chrome/browser/extensions/content_script_apitest.cc
+++ b/chrome/browser/extensions/content_script_apitest.cc
@@ -18,6 +18,7 @@
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/extension_with_management_policy_apitest.h"
 #include "chrome/browser/extensions/test_extension_dir.h"
+#include "chrome/browser/search/search.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/javascript_dialogs/javascript_dialog_tab_helper.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
@@ -622,6 +623,35 @@ IN_PROC_BROWSER_TEST_P(ContentScriptApiTest,
   EXPECT_FALSE(content_script_listener.was_satisfied());
 }
 
+IN_PROC_BROWSER_TEST_P(ContentScriptApiTest, CannotScriptTheNewTabPage) {
+  ASSERT_TRUE(StartEmbeddedTestServer());
+
+  ExtensionTestMessageListener test_listener("ready", true);
+  LoadExtension(test_data_dir_.AppendASCII("content_scripts/ntp"));
+  ASSERT_TRUE(test_listener.WaitUntilSatisfied());
+
+  auto did_script_inject = [](content::WebContents* web_contents) {
+    bool did_inject = false;
+    EXPECT_TRUE(content::ExecuteScriptAndExtractBool(
+        web_contents,
+        "domAutomationController.send(window.didInject != undefined);",
+        &did_inject));
+    return did_inject;
+  };
+
+  // First, test the executeScript() method.
+  ResultCatcher catcher;
+  test_listener.Reply(std::string());
+  ASSERT_TRUE(catcher.GetNextResult()) << catcher.message();
+  EXPECT_FALSE(

[karandeepb, 2017/07/18 19:26:59]

nit: Also verify that the active web contents url is the new tabs page.

[Devlin, 2017/07/18 20:53:46]

Done.

+      did_script_inject(browser()->tab_strip_model()->GetActiveWebContents()));
+
+  // Next, check content script injection.

[karandeepb, 2017/07/18 19:27:00]

Also check injection on a normal page first, to verify our setup.

[Devlin, 2017/07/18 20:53:46]

Done.  Good suggestion; this helped flush out a bug.

+  ui_test_utils::NavigateToURL(browser(), search::GetNewTabPageURL(profile()));
+  EXPECT_FALSE(
+      did_script_inject(browser()->tab_strip_model()->GetActiveWebContents()));
+}
+
 INSTANTIATE_TEST_CASE_P(
     ContentScriptApiTests,
     ContentScriptApiTest,